使这个病毒：trojan.dl.ieframe.bm


用avg查叫做：Hijacker.IFrame.br
每次杀掉之后，过一阵子又会再出现，有时候几个小时，有时候干脆就是几天之后再出现
用诺顿查不出来，用恶意软件清理助手也没有效果
另外，包括用360的安天查木马也不行，查不出来

有的时候会感染很多文件，但基本都是哪些上网的临时文件和cookies之类的

请问大家知道怎么彻底消灭它吗？



avg的纪录:
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\HGZ3AJNZ\homePageBottomImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\HGZ3AJNZ\homePageRightImg2[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\SocietyLeftSmallTop[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\contentFocusImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\homePageLeftImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\homePageMiddleImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\homePageTopTwoImgLeft[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\huarenTopImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\TLS0GMO0\societyTopImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YTTL808I\SocietyLeftSmallFooter[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YTTL808I\SocietyMid[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YTTL808I\contentFocusImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YTTL808I\homePageRightImg1[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YTTL808I\homePageTwoImgRight[1].js -> Hijacker.IFrame.br : Cleaned.




瑞星的记录：
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\w8qxabe4      文件名：28942014[1].htm    来源：本机

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; CIBA)

这是日志

楼上是我刚扫的，只是由于该病毒复活的时间间隔不确定，此病毒暂时还没有再次复活
在这种情况下，不知SRENG日志还有没有用 
  谢谢了

已经进行了此操作，但完全没有效果
这是刚才的查毒结果：

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at:    13:39:45 2008-6-12

+ Scan result:   



C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\contentFocusImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\contentTopImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\homePageBottomImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\homePageMiddleImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\homePageTwoImgRight[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\worldRightImg2[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\D39P8YA7\worldTopTwoImgRight[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\SZ2Q5QA4\worldMiddleTwoImgLeft[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\WWPV5O3K\contentFocusImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\WWPV5O3K\contentFocusImg[2].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\WWPV5O3K\contentTopImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\WWPV5O3K\homePageLeftImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\WWPV5O3K\worldRightImg1[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YON4WP5J\contentTopImg[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YON4WP5J\homePageLeftImg1[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YON4WP5J\homePageTopTwoImgLeft[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YON4WP5J\worldMiddleTwoImgRight[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YON4WP5J\worldRightImg3[1].js -> Hijacker.IFrame.br : Cleaned.
C:\Documents and Settings\S.R\Local Settings\Temporary Internet Files\Content.IE5\YON4WP5J\worldTopTwoImgLeft[1].js -> Hijacker.IFrame.br : Cleaned.


::Report end

这个病毒还是会复活，请问是否还有别的方法？

是局域网没错
但一直用360的ARP防火墙，同时还有诺顿的网络特警防火墙，二者是同时使用的
只有几天前偶然关闭了ARP防火墙大约2个小时(似乎就是病毒出现的前后时间吧，但实在记不清了），此外一直都是开着的

windows的补丁和杀毒软件，防火墙的更新也一直都很及时的
不明白为什么会这样

我们这里确实有arp攻击
我刚刚运行cmd查网关的mac
用的是ping 192.168.1.1  然后arp -a
怎么出来三个呢?

192.168.1.1    00-1d-of-60-f8-54
192.168.1.18  00-16-d3-f0-e5-62
192.168.1.107  00-1a-4b-6b-4d-1f
我该邦定哪个呢？是第一个吗？

另外，这种方法查网关的mac准确吗？

在绑定的时候，我看到有两个选项，一个是添加网关，要输入网关ip和网关mac      还有一个是添加dns,要输入dns的ip和mac
如果我你绑定网关MAC地址的话，dns的ip和mac也要手动输入一个吗？

C:\WINDOWS\system32\contmenu.dll是雅虎助手留下的程序吗？
我不太明白
怎么提到这个了呢？


另外，尽管我所在的局域网有攻击，但病毒是在另一个环境里染上的，应该和现在的网络关系不大吧

我是在学校的大网上网，没办法管别人的机器，学校也不会去处理
莫非我应该重装机器？
请问你知道这个冬冬具体有什么危害吗？如果危害不大的话，干脆不管了·····

谢谢版主啦